AdrianStrugala / AvroConvert

Rapid Avro serializer for C# .NET
Other
102 stars 27 forks source link

Attempt to deserialise incorrectly formatted stream causes stack overflow error #151

Open alex-ntk opened 6 months ago

alex-ntk commented 6 months ago

What is the bug?

Avro deserialiser can cause stack overflow exception when deserialising crafted message.

How to reproduce?

public class TestMessage
{
    public string Body { get; set; }
}

var msg = new TestMessage { Body = "OK" };
var data = AvroConvert.Serialize(msg);
data[5] = 0x67;
var msg2 = AvroConvert.Deserialize<TestMessage>(data); // crashes here

What is the Avro data? Fill up the section or provide a sample file

Base64 data:

T2JqAQRnYXZyby5jb2RlYwhudWxsFmF2cm8uc2NoZW1h2AF7Im5h
bWUiOiJUZXN0TWVzc2FnZSIsIm5hbWVzcGFjZSI6IlRlc3RQcm9qZW
N0MSIsInR5cGUiOiJyZWNvcmQiLCJmaWVsZHMiOlt7Im5hbWUiOiJ
Cb2R5IiwidHlwZSI6InN0cmluZyJ9XX0A7Gd+lRgoLGnc1A0NySGRX
AIGBE9L7Gd+lRgoLGnc1A0NySGRXA==

What is the expected behavior?

throw exception that is easy to catch, not StackOverflow exception.

What could be the reason of the bug?

image

AdrianStrugala commented 6 months ago

Hello, Thank you for your idea. I will take a look at the exception handling. Best, Adrian